<html>
<head><meta charset="utf-8"><title>Soundness of `exhaustive_patterns` · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html">Soundness of `exhaustive_patterns`</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="218791869"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791869" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791869">(Dec 04 2020 at 03:57)</a>:</h4>
<p>I have a question about partially initialized values related to the <code>exhaustive_patterns</code> feature. This feature allows omitting match branches when the pattern is for an uninhabited type. We worry that might introduce unsoundness.</p>



<a name="218791876"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791876" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791876">(Dec 04 2020 at 03:57)</a>:</h4>
<p>Specifically, it allows the following code:</p>



<a name="218791878"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791878" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791878">(Dec 04 2020 at 03:57)</a>:</h4>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">union</span> <span class="nc">Uninit</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="n">value</span>: <span class="nc">ManuallyDrop</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"></span>
<span class="w">  </span><span class="n">uninit</span>: <span class="p">(),</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
<span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">u64</span> <span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span>: <span class="nc">Uninit</span><span class="o">&lt;</span><span class="p">(</span><span class="kt">u32</span><span class="p">,</span><span class="w"> </span><span class="o">!</span><span class="p">)</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">Uninit</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">uninit</span>: <span class="p">()</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="w">    </span><span class="p">(</span><span class="o">*</span><span class="n">x</span><span class="p">.</span><span class="n">value</span><span class="p">).</span><span class="mi">0</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">22</span><span class="p">;</span><span class="w"> </span><span class="c1">// Initialize first part of the tuple</span>
<span class="w">    </span><span class="k">match</span><span class="w"> </span><span class="o">*</span><span class="n">x</span><span class="p">.</span><span class="n">value</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="w">  </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="218791888"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791888" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791888">(Dec 04 2020 at 03:57)</a>:</h4>
<p>This seems bad. Would matching on a partially-initialized value otherwise be ok (i.e. not UB)?</p>



<a name="218791929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791929">(Dec 04 2020 at 03:58)</a>:</h4>
<p>Cf <a href="https://github.com/rust-lang/rust/issues/51085">https://github.com/rust-lang/rust/issues/51085</a> for context about the feature</p>



<a name="218791968"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218791968" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218791968">(Dec 04 2020 at 04:00)</a>:</h4>
<p>Currently if I add a <code>(v, _) =&gt; println!("{}", v);</code> branch to the match, it executes nicely, even in MIRI (<a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=8426097da3441798bc5b4e580d9fb077">playground</a>). If this would be ok and not UB, then the feature is unsound</p>



<a name="218792057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218792057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218792057">(Dec 04 2020 at 04:01)</a>:</h4>
<p>My reading of the nomicon seems to indicate that a partially-initialized tuple is invalid, and I guess matching an invalid value is UB, but I'm not very sure I'm understanding right</p>



<a name="218792218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218792218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218792218">(Dec 04 2020 at 04:04)</a>:</h4>
<p>Ping <span class="user-mention" data-user-id="120791">@RalfJ</span>, I've been told you would know</p>



<a name="218793701"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218793701" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218793701">(Dec 04 2020 at 04:38)</a>:</h4>
<p>At the very least, producing (IE. performing a typed copy) or operating on an invalid value is undefined behaviour (as to whether or not it is even permitted to exist, I believe this goes into <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/84">https://github.com/rust-lang/unsafe-code-guidelines/issues/84</a> territory). I would assume this extends to matching or using a pattern guard on an invalid value. And <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/69">https://github.com/rust-lang/unsafe-code-guidelines/issues/69</a> seems to say that, yes, an aggregate containing an invalid field is itself invalid.</p>



<a name="218796183"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218796183" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218796183">(Dec 04 2020 at 05:39)</a>:</h4>
<p>I would expect you to need <code>match *x.value.0</code> for this to be valid</p>



<a name="218796189"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218796189" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218796189">(Dec 04 2020 at 05:39)</a>:</h4>
<p>otherwise like you said, you have a value of an uninhabited type</p>



<a name="218796244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218796244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218796244">(Dec 04 2020 at 05:40)</a>:</h4>
<p>maybe we could make <code>match *x.value</code> a compiler warning that's deny-by-default?</p>



<a name="218844910"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218844910" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218844910">(Dec 04 2020 at 15:14)</a>:</h4>
<p>Does an uninitialized value count as an invalid value?</p>



<a name="218845305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218845305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218845305">(Dec 04 2020 at 15:16)</a>:</h4>
<p>Also something else that <span class="user-mention" data-user-id="120791">@RalfJ</span> pointed out <a href="https://github.com/rust-lang/rust/issues/78123#issuecomment-737746503">here</a>: even if the current rules disallow matching on partially-uninitialized values, might that ever be relaxed in the future? If yes then the compiler should not rely on it being illegal</p>



<a name="218845741"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218845741" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218845741">(Dec 04 2020 at 15:19)</a>:</h4>
<p>I think it is appropriate to allow the match compiler to access whatever it needs to of the scrutinee, which would support the interpretation that the argument to a <code>match</code> must be fully initialized (counts as a use)</p>



<a name="218846044"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218846044" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218846044">(Dec 04 2020 at 15:21)</a>:</h4>
<p>an uninitialized value is different from an invalid value - the type system treats them very differently because initialization requires an initial data flow analysis that has to be mostly syntactic because programmers have to reason about it</p>



<a name="218846687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218846687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218846687">(Dec 04 2020 at 15:26)</a>:</h4>
<p>Actually looking at your code you mean uninitialized at runtime, not statically as in <code>let x: (u32, !); x.0 = 22;</code>. I agree that the rules about what a match actually "uses" on its input are not entirely clear, I think Ralf has a post about that somewhere</p>



<a name="218846829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218846829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218846829">(Dec 04 2020 at 15:27)</a>:</h4>
<p>Ah, that would be quite helpful if it's been written down somewhere</p>



<a name="218854355"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218854355" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218854355">(Dec 04 2020 at 16:15)</a>:</h4>
<p>I've scrolled through Ralf's blog but couldn't see something that looked like that</p>



<a name="218862456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218862456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218862456">(Dec 04 2020 at 17:14)</a>:</h4>
<p>I was worried that the following code might have compiled:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="cp">#![feature(never_type)]</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="w"> </span><span class="p">()</span><span class="w"></span>
<span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span>: <span class="p">(</span><span class="kt">u32</span><span class="p">,</span><span class="w"> </span><span class="o">!</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="n">x</span><span class="p">.</span><span class="mi">0</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">22</span><span class="p">;</span><span class="w"> </span><span class="c1">// initialize first part of the tuple</span>
<span class="w">    </span><span class="k">match</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">(</span><span class="n">v</span><span class="p">,</span><span class="w"> </span><span class="n">_</span><span class="p">)</span><span class="w"> </span><span class="o">=&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="c1">// access only first part of the tuple</span>
<span class="w">        </span><span class="n">println</span><span class="o">!</span><span class="p">(</span><span class="s">"{}"</span><span class="p">,</span><span class="w"> </span><span class="n">v</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="p">}}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>Luckily <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7ba16bde94fe18f61160def362bfe001">it does fail</a> with:</p>
<div class="codehilite" data-code-language="Text only"><pre><span></span><code>error[E0381]: assign to part of possibly-uninitialized variable: `x`
 --&gt; src/main.rs:6:5
  |
6 |     x.0 = 22; // initialize first part of the tuple
  |     ^^^^^^^^ use of possibly-uninitialized `x`

error: aborting due to previous error
</code></pre></div>
<p>which does show that partial initialization of aggregates is non-trivial, even in statically guaranteed cases.</p>
<p>To me, a very simple model (<em>i.e.</em>, a <em>safer</em> model, since for these things subtlety leads to footguns and things being error-prone) is to require that for a <code>union</code> (ideally, all <code>union</code>s, at worst, only <code>#[repr(Rust)]</code> <code>union</code>s), whenever a place in a variant is <em>read</em> / used as a value, then that the whole variant in the <code>union</code> be<em>valid</em> (this remains more lenient than the <em>active variant</em> rule from C++): if people need more fine-grained initialization, all they have to do is wrap each field of the variant in a <code>MaybeUninit</code>!</p>
<p>So the main point here would be to justify why/when the above model, especially when each field (within a variant) can be <code>MaybeUninit</code>-wrapped, would not be expressive / flexible enough (thinking of some very shady C-isms, here), so as to justify that the language consider supporting these weird "partially inhabited/valid types/values".</p>



<a name="218877921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218877921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218877921">(Dec 04 2020 at 19:07)</a>:</h4>
<p>Hm, yet if I can write <code>let y = x.0</code> it's surprising that I can't also write <code>let (y, _) = x</code> or the equivalent match statement</p>



<a name="218878123"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218878123" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218878123">(Dec 04 2020 at 19:09)</a>:</h4>
<p>I mean, if <code>x.0</code> does not count as reading the whole of <code>x</code> as a value, I would like <code>let (y, _) = x</code> to also not count as reading the whole of <code>x</code> as a value. So we'd be back to square one, unless <code>x.0</code> also requires the whole variant to be valid</p>



<a name="218878419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218878419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218878419">(Dec 04 2020 at 19:12)</a>:</h4>
<p>Actually maybe that's what you meant</p>



<a name="218878965"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218878965" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218878965">(Dec 04 2020 at 19:16)</a>:</h4>
<p>Hm, there is a difference between <code>match</code> and destructuring <code>let</code> on partially-moved values. I imagine that similarly destructuring <code>let</code> on a partially initialized value could be ok, but not a <code>match</code> on that same value</p>



<a name="218888885"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218888885" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218888885">(Dec 04 2020 at 20:44)</a>:</h4>
<p>I'm actually thinking of a UCG issue about whether <code>&amp;!</code> is uninhabited</p>



<a name="218888924"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218888924" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218888924">(Dec 04 2020 at 20:45)</a>:</h4>
<p>or maybe it was a rust issue? I can't remember</p>



<a name="218890733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218890733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218890733">(Dec 04 2020 at 21:01)</a>:</h4>
<p><a href="https://internals.rust-lang.org/t/blog-post-never-patterns-exhaustive-matching-and-uninhabited-types/8197">this</a> looks nearest to my recollection</p>



<a name="218892017"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218892017" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218892017">(Dec 04 2020 at 21:13)</a>:</h4>
<p><a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/77">UCG#77</a> mentions <code>&amp;!</code></p>



<a name="218895058"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218895058" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218895058">(Dec 04 2020 at 21:44)</a>:</h4>
<p>niko's never patterns blog post is indeed what triggered my question. <code>&amp;!</code> is not a problem for soundness currently because exhaustiveness checking errs on the side of treating all references as inhabited</p>



<a name="218896151"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218896151" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218896151">(Dec 04 2020 at 21:55)</a>:</h4>
<p>Huh, that irlo thread is full of good info actually, thx for that</p>



<a name="218897977"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218897977" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218897977">(Dec 04 2020 at 22:12)</a>:</h4>
<p>The discussion there and here answers my question: it seems that we don't want to commit to forbidding matching on a partially initialized value right now</p>



<a name="218897988"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218897988" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218897988">(Dec 04 2020 at 22:12)</a>:</h4>
<p>Thanks for the pointers everyone!</p>



<a name="218911795"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218911795" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218911795">(Dec 05 2020 at 01:49)</a>:</h4>
<p>pointers <span aria-label="grinning face with smiling eyes" class="emoji emoji-1f601" role="img" title="grinning face with smiling eyes">:grinning_face_with_smiling_eyes:</span></p>



<a name="218935052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218935052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218935052">(Dec 05 2020 at 13:23)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245339">Nadrieril</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218844910">said</a>:</p>
<blockquote>
<p>Does an uninitialized value count as an invalid value?</p>
</blockquote>
<p>there is no such thing as an "uninitialized value" so I am not sure how to answer this question.<br>
the way values work is that there is a <em>representation</em> of the value stored in memory, and when you access memory at some type, the bytes there are interpreted according to the type to reconstruct the value of the given type. if the memory is uninitialized, then most of the time that is not a representation of any value, and thus UB. "invalid value" is short-hand for "some sequence of bytes that is not a valid representation of any value of the given type".</p>
<p>(We are often a bit sloppy about these things when it is not worth going into all the detauls, but here I felt like there's so much confusion around that being sloppy wouldn't help.^^)</p>



<a name="218936169"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218936169" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218936169">(Dec 05 2020 at 13:54)</a>:</h4>
<p>Oh I see, thanks for the precision</p>



<a name="218936872"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218936872" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218936872">(Dec 05 2020 at 14:15)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I'm even more confused by your replies on the tracking issue <a href="https://github.com/rust-lang/rust/issues/51085">https://github.com/rust-lang/rust/issues/51085</a> now &gt;&lt;</p>



<a name="218937055"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937055" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937055">(Dec 05 2020 at 14:20)</a>:</h4>
<p>I seem to understand that having a value of an uninhabited type like (u32, !) is UB today, and therefore match checking can safely assume that there will be no such value around even in the presence of unsafe code. Therefore writing <code>match x {}</code> for <code>x: (u32, !)</code> is not UB.</p>



<a name="218937190"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937190" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937190">(Dec 05 2020 at 14:25)</a>:</h4>
<p>But you also <a href="https://github.com/rust-lang/rust/issues/51085#issuecomment-739250270">said</a> that reading the initialized part of a partially-initialized value is ok, so if I create a partially-initialized value of type <code>(u32, !)</code> using unsafe then I should be allowed to read the u32 using <code>match x { (v, _) =&gt; ... }</code>. Or am I misunderstanding sth?</p>



<a name="218937520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937520">(Dec 05 2020 at 14:35)</a>:</h4>
<p><span class="user-mention" data-user-id="245339">@Nadrieril</span> so here's the thing -- if you show me some MIR code, I have a very good model for telling you whether it is UB or not. But there is no <code>match</code> in MIR. That's one of the reasons I like doing such work on MIR. :D<br>
All questions around <code>match</code> thus involve not only MIR semantics, but also the desugaring/lowering of Rust into MIR. (a) I am not very familiar with that lowering, and (b) that lowering is not governed by any guarantees or RFCs or so, so it might change.</p>



<a name="218937561"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937561" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937561">(Dec 05 2020 at 14:36)</a>:</h4>
<p>That's what makes any match-related question basically impossible to answer conclusively, I am afraid.</p>



<a name="218937572"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937572" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937572">(Dec 05 2020 at 14:37)</a>:</h4>
<p>Ah</p>



<a name="218937574"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937574" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937574">(Dec 05 2020 at 14:37)</a>:</h4>
<blockquote>
<p>Therefore writing match x {} for x: (u32, !) is not UB.</p>
</blockquote>
<p>Eh, what? I don't follow you here. "it's invalid therefore it is not UB"?<br>
also, <em>writing</em> code is never UB, <em>executing</em> it is. And executing <code>match x {}</code> is UB for any <code>x</code>, since this is clearly unreachable code, otherwise the compiler would never accept the empty match.</p>



<a name="218937617"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937617" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937617">(Dec 05 2020 at 14:38)</a>:</h4>
<p>Ah right, it appears I use those words without a good understanding of them</p>



<a name="218937624"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937624" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937624">(Dec 05 2020 at 14:38)</a>:</h4>
<p>yeah, empty types can break your mind if you are not used to them.^^ even more so in a language with unsafe operations such as Rust...</p>



<a name="218937638"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937638" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937638">(Dec 05 2020 at 14:39)</a>:</h4>
<p>Then without going into those details I clearly don't understand, my question is: can you confidently tell me whether allowing users to write <code>match x {}</code> on <code>x: (u32, !)</code> is a good idea?</p>



<a name="218937691"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937691" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937691">(Dec 05 2020 at 14:40)</a>:</h4>
<p>the simplest case is <code>x: !</code>. given that, <code>match x {}</code> is safe to write. However, if this code ever gets <em>executed</em>, that's UB. How can it be safe? Well, <code>x: !</code> can never exist, so this code can never be reached in the first place, so what happens when we reach it is a moot point.</p>
<p>that's the story without unsafe code, anyway. with unsafe code however, creating an <code>x: !</code> e.g. via <code>transmute</code> is UB in the first place, so we are still good.</p>



<a name="218937700"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937700" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937700">(Dec 05 2020 at 14:41)</a>:</h4>
<p>Ok, I follow so far</p>



<a name="218937705"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937705" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937705">(Dec 05 2020 at 14:41)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245339">Nadrieril</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218937638">said</a>:</p>
<blockquote>
<p>Then without going into those details I clearly don't understand, my question is: can you confidently tell me whether allowing users to write <code>match x {}</code> on <code>x: (u32, !)</code> is a good idea?</p>
</blockquote>
<p>I personally would rather have people write <code>match x { ! }</code>. That's why I proposed the <code>!</code> pattern to Niko, which you read about I think.</p>



<a name="218937708"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937708" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937708">(Dec 05 2020 at 14:41)</a>:</h4>
<p>but that's my own opinion, not any kind of consensus</p>



<a name="218937745"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937745" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937745">(Dec 05 2020 at 14:42)</a>:</h4>
<p>I prefer being explicit over being ergonomic</p>



<a name="218937747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937747">(Dec 05 2020 at 14:42)</a>:</h4>
<p>I know other people disagree and they have good arguments</p>



<a name="218937777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937777">(Dec 05 2020 at 14:43)</a>:</h4>
<p>Ok, I understand that too.</p>



<a name="218937778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937778">(Dec 05 2020 at 14:43)</a>:</h4>
<p>actually <code>match x { (_, !) }</code> would be even better^^</p>



<a name="218937783"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937783" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937783">(Dec 05 2020 at 14:43)</a>:</h4>
<p>that makes it fully explicit that you are taking apart the tuple to reach a proof that this is unreachable code</p>



<a name="218937792"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937792" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937792">(Dec 05 2020 at 14:44)</a>:</h4>
<p>Yeah, that's the really cool bit about never patterns indeed</p>



<a name="218937835"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937835" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937835">(Dec 05 2020 at 14:44)</a>:</h4>
<p>Follow-up question: should <code>match x { _ =&gt; ... }</code> on <code>x: (u32, !)</code> lint that the branch is unreachable?</p>



<a name="218937840"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937840" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937840">(Dec 05 2020 at 14:44)</a>:</h4>
<p>but of course people want to use <code>!</code> to make more patterns exhaustive, like making <code>Ok(_)</code> exhaustive for <code>Result&lt;_, !&gt;</code>. That is in conflict with being fully explicit.</p>



<a name="218937929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937929">(Dec 05 2020 at 14:47)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245339">Nadrieril</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218937835">said</a>:</p>
<blockquote>
<p>Follow-up question: should <code>match x { _ =&gt; ... }</code> on <code>x: (u32, !)</code> lint that the branch is unreachable?</p>
</blockquote>
<p>this boils down to whether this code "produces"/"uses" <code>x</code> or not. which is something the lang team will have to decide at some point.</p>



<a name="218937975"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937975" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937975">(Dec 05 2020 at 14:48)</a>:</h4>
<p>a related question is whether <code>let _ = *foo;</code> actually dereferences <code>foo</code> to "produce" the value or not.</p>



<a name="218937978"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937978" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937978">(Dec 05 2020 at 14:48)</a>:</h4>
<p>Ok, so to be conservative I should not lint that the branch is unreachable</p>



<a name="218937990"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937990" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937990">(Dec 05 2020 at 14:49)</a>:</h4>
<p>currently this does not even require <code>unsafe</code> oO</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="n">foo</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">foo</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="218937997"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937997" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937997">(Dec 05 2020 at 14:49)</a>:</h4>
<p><code>_</code> patterns are weird^^</p>



<a name="218937998"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218937998" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218937998">(Dec 05 2020 at 14:49)</a>:</h4>
<p>huh indeed</p>



<a name="218938056"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938056" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938056">(Dec 05 2020 at 14:50)</a>:</h4>
<p>and this</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="n">foo</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="p">(</span><span class="kt">i32</span><span class="p">,</span><span class="w"> </span><span class="kt">i32</span><span class="p">))</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="p">(</span><span class="n">x</span><span class="p">,</span><span class="w"> </span><span class="n">_</span><span class="p">)</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">foo</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>compiles effectively to <code>let x = (*foo).0</code>, so the second field never gets loaded, so there is no UB when it is uninitialized</p>



<a name="218938063"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938063" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938063">(Dec 05 2020 at 14:51)</a>:</h4>
<p>but that might just be what happens to happen; this does not mean there is a guarantee that things will stay that way</p>



<a name="218938069"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938069" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938069">(Dec 05 2020 at 14:51)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218937929">said</a>:</p>
<div class="codehilite"><pre><span></span><code>this boils down to whether this code &quot;produces&quot;/&quot;uses&quot; `x` or not. which is something the lang team will have to decide at some point.
</code></pre></div>
<p>Oh I see why I keep being confused: using a value asserts its validity. It feels kinda backwards causality</p>



<a name="218938075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938075">(Dec 05 2020 at 14:51)</a>:</h4>
<p>it's all about precisely defining the verb "using"</p>



<a name="218938077"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938077" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938077">(Dec 05 2020 at 14:51)</a>:</h4>
<p>which it turns out is hard^^</p>



<a name="218938129"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938129" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938129">(Dec 05 2020 at 14:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218938063">said</a>:</p>
<blockquote>
<p>but that might just be what happens to happen; this does not mean there is a guarantee that things will stay that way</p>
</blockquote>
<p>Right now you are allowed to write <code>let (y, _) = x</code> if we moved out <code>x.1</code> already. The corresponding match is not allowed tho</p>



<a name="218938154"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938154" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nadrieril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938154">(Dec 05 2020 at 14:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218938075">said</a>:</p>
<blockquote>
<p>it's all about precisely defining the verb "using"</p>
</blockquote>
<p>Ohh and that's where never patterns come in: they make it crystal clear that the value is being read</p>



<a name="218938866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938866">(Dec 05 2020 at 15:10)</a>:</h4>
<p><span class="user-mention silent" data-user-id="245339">Nadrieril</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218938154">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218938075">said</a>:</p>
<blockquote>
<p>it's all about precisely defining the verb "using"</p>
</blockquote>
<p>Ohh and that's where never patterns come in: they make it crystal clear that the value is being read</p>
</blockquote>
<p>yes exactly :)</p>



<a name="218938877"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938877" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938877">(Dec 05 2020 at 15:11)</a>:</h4>
<p>well this prompted me to look at bit deeper and I found something concerning^^ <a href="https://github.com/rust-lang/rust/issues/79735">https://github.com/rust-lang/rust/issues/79735</a></p>



<a name="218938880"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218938880" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218938880">(Dec 05 2020 at 15:11)</a>:</h4>
<p>I also opened <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/261">https://github.com/rust-lang/unsafe-code-guidelines/issues/261</a> for the "_" pattern weirdness in general.</p>



<a name="218944645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218944645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218944645">(Dec 05 2020 at 17:34)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218938877">said</a>:</p>
<blockquote>
<p>well this prompted me to look at bit deeper and I found something concerning^^ <a href="https://github.com/rust-lang/rust/issues/79735">https://github.com/rust-lang/rust/issues/79735</a></p>
</blockquote>
<p><code>!</code> and <code>enum Void {}</code> behaving differently is concerning</p>
<p>It also means that somebody doing <code>let _ = *::core::ptr::null::&lt;::core::convert::Infallible&gt;();</code> will see its code breaking the moment <code>Infallible</code> is defined as an alias for <code>!</code> <span aria-label="cold sweat" class="emoji emoji-1f630" role="img" title="cold sweat">:cold_sweat:</span></p>



<a name="218944665"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218944665" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218944665">(Dec 05 2020 at 17:35)</a>:</h4>
<p>I think that code is already broken, heh</p>



<a name="218944670"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218944670" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218944670">(Dec 05 2020 at 17:35)</a>:</h4>
<p>(and if it happens to take place within <code>unsafe</code> "hygiene", UB-inducing rather than compile-time breaking)</p>



<a name="218977903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218977903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218977903">(Dec 06 2020 at 09:25)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60/near/218937990">said</a>:</p>
<blockquote>
<p>currently this does not even require <code>unsafe</code> oO</p>
<p><div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="n">foo</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">foo</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div><br>
</p>
</blockquote>
<p><span aria-label="scream" class="emoji emoji-1f631" role="img" title="scream">:scream:</span></p>



<a name="218980756"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218980756" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218980756">(Dec 06 2020 at 10:42)</a>:</h4>
<p>I have no idea how to feel about this. On the one hand this notation is used often to denote an operation with discarded result, so it should actually do the dereference and be UB, but on the other hand match statements have this weird syntax where you don't so much access the scrutinee as construct a place that is accessed in the patterns, so if your pattern says nothing is accessed then nothing should happen.</p>



<a name="218998394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218998394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matt1992 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218998394">(Dec 06 2020 at 18:39)</a>:</h4>
<p>Here's some <em>safe</em> code that dereferences a reference without moving the referent:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">bar</span>: <span class="kp">&amp;</span><span class="nb">String</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">bar</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>Is the idea that this function can emit a no-op load for the <code>let</code> statement?</p>



<a name="218998534"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218998534" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218998534">(Dec 06 2020 at 18:43)</a>:</h4>
<p>I think the point that is coming to light is that this does nothing at all</p>



<a name="218998537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218998537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218998537">(Dec 06 2020 at 18:43)</a>:</h4>
<p>it has 0 lines of code in MIR</p>



<a name="218998586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/218998586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#218998586">(Dec 06 2020 at 18:44)</a>:</h4>
<p>so it doesn't "dereference a reference", it constructs a place and does nothing with it</p>



<a name="219000025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219000025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219000025">(Dec 06 2020 at 19:18)</a>:</h4>
<p>well, it does nothing at all <em>under the current MIR lowering</em></p>



<a name="219000034"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219000034" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219000034">(Dec 06 2020 at 19:18)</a>:</h4>
<p>to what extend this is the result of an intentional design process, and to what extend this is meant to be or not be UB, I cannot say</p>



<a name="219000037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219000037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219000037">(Dec 06 2020 at 19:18)</a>:</h4>
<p>earlier versions of Rust <em>did</em> require <code>unsafe</code> here</p>



<a name="219000040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219000040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219000040">(Dec 06 2020 at 19:18)</a>:</h4>
<p>(before unsafety checking was moved to MIR)</p>



<a name="219007028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219007028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219007028">(Dec 06 2020 at 20:06)</a>:</h4>
<p>I'd note that <code>*ptr</code> on it's own requires unsafe, so I think that should be considered.</p>



<a name="219014610"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219014610" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219014610">(Dec 06 2020 at 20:47)</a>:</h4>
<p>It seems like this is a conflict of reasonable rules, and as a result rust's implementation is not consistent. (We poke fun at LLVM for this but it can happen to us too.)</p>



<a name="219015199"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219015199" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219015199">(Dec 06 2020 at 20:50)</a>:</h4>
<p>A spec is supposed to solve these problems, although really it just front loads the issue if we don't know which approach to take</p>



<a name="219015698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219015698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219015698">(Dec 06 2020 at 20:53)</a>:</h4>
<p>Does <code>(*ptr).0</code> desugar to an access through a reference like <code>(*(&amp;mut *ptr)).0</code>?</p>



<a name="219015880"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness%20of%20%60exhaustive_patterns%60/near/219015880" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Soundness.20of.20.60exhaustive_patterns.60.html#219015880">(Dec 06 2020 at 20:54)</a>:</h4>
<p>if so then there might be a way out such that the MIR contains the ptr-to-reference operation but not the subsequent field access</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>